diff --git a/.gitignore b/.gitignore
index 59756d9..d5d6726 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,4 @@
 /mbedtls-2.16.3-apache.tgz
 /mbedtls-2.16.4-apache.tgz
 /mbedtls-2.16.5-apache.tgz
+/mbedtls-2.16.6-apache.tgz
diff --git a/mbedtls.spec b/mbedtls.spec
index 1501790..05dbb74 100644
--- a/mbedtls.spec
+++ b/mbedtls.spec
@@ -3,7 +3,7 @@
 %endif
 
 Name: mbedtls
-Version: 2.16.5
+Version: 2.16.6
 Release: 1%{?dist}
 Summary: Light-weight cryptographic and SSL/TLS library
 License: ASL 2.0
@@ -122,6 +122,10 @@ LD_LIBRARY_PATH=$PWD/library ctest --output-on-failure -V
 %doc apidoc/*
 
 %changelog
+* Wed May 27 2020 Morten Stevens <mstevens@fedoraproject.org> - 2.16.6-1
+- Update to 2.16.6
+- Security Advisory 2020-04 (CVE-2020-10932)
+
 * Tue Mar 03 2020 Morten Stevens <mstevens@fedoraproject.org> - 2.16.5-1
 - Update to 2.16.5
 
diff --git a/sources b/sources
index 4a86610..1faf1f1 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (mbedtls-2.16.5-apache.tgz) = 89a6a2cc6fe8b568396caed5fe8428ff5debf833c643b0e4c3144fdc474b127d156d8f5e5ea47a8b5d6522a2689e91a57abc533390b3f54aaa2c756ef6d3baf7
+SHA512 (mbedtls-2.16.6-apache.tgz) = a0c48b694d7bc70256d26c44bfb2ac802428560b02e50fe2e47762bc595e2c7b8fac934badb3452acb01d8a54386eafae0ff2894320d24ab7554f1c8e6cb4bcf